CVE-2017-6930

In Drupal versions 8.4.x versions before 8.4.5 when using node access controls with a multilingual site, Drupal marks the untranslated version of a node as the default fallback for access queries. This fallback is used for languages that do not yet have a translated version of the created node...

CVE-2017-6930

Summary (grounded): CVE-2017-6930 affects Drupal 8.4.x prior to 8.4.5 where, on multilingual sites using node access controls, the untranslated node is incorrectly treated as the default fallback for access queries. This can enable an access bypass. The issue is limited to sites that use the Cont...

Semrush: CORS (Cross-Origin Resource Sharing)

Affected URL: https://ta.semrush.com/version/ Description: The application implements an HTML5 cross-origin resource sharing CORS policy for this request which allows access from any domain. Allowing access from all domains means that any domain can perform two-way interaction with the applicatio...

Android WebView Cross Domain Access Vulnerability

Android WebView web view is a control for displaying html text content on Android platform. Android WebView has a cross domain access vulnerability. The vulnerability occurs because the Android application WebView opens the file domain access, and allows the file domain to access the http domain,...

The vulnerability of the Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Netlogon service in the Windows operating system is related to the improper creation of secure communication channels. Exploiting this vulnerability can allow an attacker, operating locally, to increase their privileges by using access to the domain...

Vulnerability of the Internet Explorer browser, leading to the disclosure of confidential information

The Internet Explorer browser contains a vulnerability related to domain-level restrictions. Exploiting this vulnerability allows a malicious individual to gain access to confidential information through a specially crafted web page that the user visits. If successful, the malicious individual wi...

Samba denial of service vulnerability

Samba is a set of programs that implement the SMB Server Messages Block protocol, cross-platform file sharing and print sharing services. The samldbcheckuseraccountcontrolacl function in the dsdb/samdb/ldbmodules/samldb.c file is vulnerable to a denial of service. Denial of Service Vulnerability...

Unable to log in to PVS console, error: The domain/user does not have access to the Farm

When a domain user tries to log in to the PVS console, gets error: "The domain/user does not have access to the Farm." The environment may or may not have multiple PVS sites and/or multiple domains. The domain user has been added to the "Farm Administrators" under the Security tab on the Farm...

Shopify: Staff members with no permission to access domains can access them.

Hi , I have found that if a staff member has a permission to access settings but has no permissions to access domains he can bypass this by just going to: store.myshopify.com/admin/settings/domains . in the side menu the domains tab will be disabled and the user shouldn't be able to access it,but...

The vulnerability of the iOS operating system allows a perpetrator to circumvent access restrictions and gain access to protected information.

The vulnerability of the WebKit Canvas implementation in the iOS operating system is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to bypass access restrictions and gain access to protected information by overriding the domain access...

Internet Bug Bounty: Internet-based attacker can run Flash apps in local sandboxes by using special URL schemes (PSIRT-3299, CVE-2015-3079)

Some of the sandbox logic of Flash Player can be circumvented on most web browsers by using special URL schemes. A website can deploy an SWF file via the data: or blob: URL schemes perhaps others. An app started in this way runs in the "local with files" or "local with networking" sandbox,...

Adobe Flash Player Cross Domain Policy Bypass (APSB15-11: CVE-2015-3099)

Adobe Flash Player is vulnerable to a cross domain policy bypass. If the victim opens a maliciously crafted file using certain URL, the file could cause a privilege escalation and allow unlimited cross-domain access...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

Web Site Client Access Policy File Detection

The remote web server contains a client access policy file. This is a simple XML file used by Microsoft Silverlight to allow access to services that reside outside the exact web domain from which a Silverlight control originated. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Cross domain access to object constructors can be used to facilitate cross-site scripting – Opera Security Advisories

JavaScripts are able to redefine and override the methods of native objects. They may also do this with the native objects of any document that shares the same origin. By redefining the methods of another document through the constructor property of the document’s host objects, a malicious script...

PT-2012-3623 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 9 Description: The issue allows remote attackers to read content from a different domain or zone via a crafted web site. An information disclosure vulnerability exists that could allow an attacke...

USN-1184-1: Firefox and Xulrunner vulnerabilities

Gary Kwong, Igor Bukanov, and Bob Clary discovered multiple memory vulnerabilities in the browser rendering engine. An attacker could use these to possibly execute arbitrary code with the privileges of the user invoking Firefox. CVE-2011-2982 It was discovered that a vulnerability in event...

PT-2011-2983 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Microsoft Internet Explorer versions 6 through 7 Description: The issue allows remote attackers to obtain sensitive information via a crafted web site. An information disclosure vulnerability exists that could allow script to gain access to...

Microsoft Internet Explorer Multiple Vulnerabilities (2497640)

This host is missing a critical security update according to Microsoft Bulletin MS11-018. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

SA-CONTRIB-2010-096 - Domain access - Multiple Vulnerabilities

The Domain Access module suite allows users to maintain content shared across multiple domains running from a single Drupal installation. In several instances, the module does not sanitize the user-supplied domain name before displaying it, leading to a Cross-Site Scripting XSS vulnerability that...